CVSS: 3.5EPSS: 0%CPEs: 15EXPL: 0CVE-2016-1500
https://notcve.org/view.php?id=CVE-2016-1500
08 Jan 2016 — ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belonging to a sharing user by leveraging an incoming share. ownCloud Server en versiones anteriores a 7.0.12, 8.0.x en versiones anteriores a 8.0.10, 8.1.x en versiones anteriores a 8.1.5 y 8.2.x en versiones anteriores ... • https://owncloud.org/security/advisory/?id=oc-sa-2016-003 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2016-1501
https://notcve.org/view.php?id=CVE-2016-1501
08 Jan 2016 — ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages. ownCloud Server en versiones anteriores a 8.0.9 y 8.1.x en versiones anteriores a 8.1.4 permiten a usuarios remotos autenticados obtener información sensible a través de vectores no especificados, lo que revela la ruta de instalación en los mensajes de excepción resultantes. • https://owncloud.org/security/advisory/?id=oc-sa-2016-004 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.5EPSS: 0%CPEs: 7EXPL: 2CVE-2016-1499 – ownCloud 8.2.1 / 8.1.4 / 8.0.9 Information Exposure
https://notcve.org/view.php?id=CVE-2016-1499
07 Jan 2016 — ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php. ownCloud Server en versiones anteriores a 8.0.10, 8.1.x en versiones anteriores a 8.1.5 y 8.2.x en versiones anteriores a 8.2.2 permite a usuarios remotos autenticados obtener información sensible desde un listado de directorio ... • https://packetstorm.news/files/id/135158 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5955
https://notcve.org/view.php?id=CVE-2015-5955
29 Oct 2015 — ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie information by reading authentication headers. Aplicación ownCloud iOS en versiones anteriores a 3.4.4 no cambia adecuadamente el estado entre múltiples instancias, lo que permite a administradores remotos de instancias obtener información sensible de credencial y cookie mediante lectura de cabeceras de autenticación. • https://owncloud.org/security/advisory/?id=oc-sa-2015-013 • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2015-7698
https://notcve.org/view.php?id=CVE-2015-7698
21 Oct 2015 — icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php. icewind1991 SMB en versiones anteriores a 1.0.3 permite a usuarios remotos autenticados ejecutar comandos SMB arbitrarios a través de metacaracteres de shell en el argumento user en la función (1) listShares en server.php o (2) connect o (3) read en Share.php. • https://github.com/icewind1991/SMB/commit/33ab10cc4d5c3e48cba3a074b5f9fc67590cd032 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2015-5953 – Debian Security Advisory 3373-1
https://notcve.org/view.php?id=CVE-2015-5953
19 Oct 2015 — Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " (double quote) character in a filename in a shared folder. Vulnerabilidad de XSS en la aplicación activity en ownCloud Server en versiones anteriores a 7.0.5 y 8.0.x en versiones anteriores a 8.0.4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un... • http://www.debian.org/security/2015/dsa-3373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 12EXPL: 0CVE-2015-5954 – Debian Security Advisory 3373-1
https://notcve.org/view.php?id=CVE-2015-5954
19 Oct 2015 — The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder. El sistema de archivos en ownCloud Server en versiones anteriores a 6.0.9, 7.0.x en versiones anteriores a 7.0.7 y 8.0.x en versiones anteriores a 8.0.5 no considera que NULL es un va... • http://www.debian.org/security/2015/dsa-3373 •
CVSS: 10.0EPSS: 23%CPEs: 5EXPL: 0CVE-2015-4716 – Debian Security Advisory 3373-1
https://notcve.org/view.php?id=CVE-2015-4716
19 Oct 2015 — Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors. Vulnerabilidad de salto de directorio en el componente routing en ownCloud Server en versiones anteriores a 7.0.6 y 8.0.x en versiones anteriores a 8.0.4, cuando se ejecuta en Windows, permite a atacantes remotos reinstalar la aplicación o ejecutar código arbitrario a... • http://www.debian.org/security/2015/dsa-3373 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2015-4717 – Debian Security Advisory 3373-1
https://notcve.org/view.php?id=CVE-2015-4717
19 Oct 2015 — The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names. El componente de saneo de nombre de archivo en ownCloud Server en versiones anteriores a 6.0.8, 7.0.x en versiones anteriores a 7.0.6 y 8.0.x en versiones anteriores a 8.0.4 no maneja correctamente la... • http://www.debian.org/security/2015/dsa-3373 • CWE-399: Resource Management Errors •
CVSS: 9.0EPSS: 0%CPEs: 10EXPL: 0CVE-2015-4718 – Debian Security Advisory 3373-1
https://notcve.org/view.php?id=CVE-2015-4718
19 Oct 2015 — The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file. El controlador de almacenamiento SMB externo en ownCloud Server en versiones anteriores a 6.0.8, 7.0.x en versiones anteriores a 7.0.6 y 8.0.x en versiones anteriores a 8.0.4 permite a usuarios remotos autenticados ejecutar comandos SMB arbitrarios a través de un carácter ; (punto y coma) en un... • http://www.debian.org/security/2015/dsa-3373 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •